Pennsylvania Cyber Laws

Last verified: November 8, 2026

This guide covers the Pennsylvania laws that matter most when something happens to you online: intimate images, AI fakes, sextortion, data breaches, privacy, and AI. Each section tells you what the law does and whether it gives you the right to sue. Federal law applies on top of all of it.

Intimate Image Abuse and Revenge Porn

Can you sue? Yes.

Under 18 Pa.C.S. § 3131, it is a crime to disseminate a nude or sexual image of a current or former sexual or intimate partner with intent to harass, annoy, or alarm. It is a second-degree misdemeanor when the person depicted is an adult and a first-degree misdemeanor when the person depicted is a minor. Victims can sue under 42 Pa.C.S. § 8316.1 for actual damages or $500, whichever is greater. The court may award up to three times actual damages, plus reasonable attorney fees and court costs.

Sexual Deepfakes and AI-Generated Images

Can you sue? Yes, under the same civil statute.

Act 125 of 2024 added a separate offense to § 3131 for disseminating an artificially generated sexual depiction of any individual with intent to harass, annoy, or alarm. No relationship is required. The law covers images that appear to authentically show a person nude or in sexual conduct that never happened, made with technical means such as AI or photo editing software. It is a second-degree misdemeanor when the person depicted is an adult and a first-degree misdemeanor when the person depicted is a minor. Because the civil claim in 42 Pa.C.S. § 8316.1 is tied to § 3131, it reaches AI-generated sexual depictions too. Act 125 also expanded Pennsylvania's child sexual abuse material law, 18 Pa.C.S. § 6312, to cover AI-generated material, a felony. Separately, Act 35 of 2025 created the crime of digital forgery, 18 Pa.C.S. § 4101.1, for creating and distributing a forged digital likeness with intent to defraud or injure. It is a first-degree misdemeanor, or a third-degree felony when part of a scheme to defraud, coerce, or steal. That law is criminal only and does not give victims their own claim.

Sextortion

Can you sue? Not under this statute. Other civil claims may apply.

Under 18 Pa.C.S. § 3133, sexual extortion includes demanding money or sexual images by threatening to release intimate material. It is a first-degree misdemeanor, up to 5 years in prison, and a third-degree felony, up to 7 years, in listed circumstances including when the victim is under 18 or the offender has a pattern of this conduct. Federal law also makes threatening to publish an intimate image, real or AI-generated, a crime under the TAKE IT DOWN Act.

Data Breach Notification

Can you sue? Yes, for negligence.

Pennsylvania's Breach of Personal Information Notification Act, 73 P.S. § 2301 et seq., requires businesses to notify Pennsylvania residents when their personal information is breached. Act 33 of 2024, effective September 26, 2024, added two major requirements. When a breach requires notice to more than 500 Pennsylvania residents, the business must notify the Pennsylvania Attorney General at the same time it notifies the residents. And when the breach involves a Social Security number, bank account number, driver's license number, or state ID number, the business must offer affected residents 12 months of free credit reporting or credit monitoring. Pennsylvania is one of only a handful of states with a credit monitoring requirement. If your personal information was exposed in a breach, you may be able to sue the company that held it. In Dittman v. UPMC (2018), the Pennsylvania Supreme Court held that an employer owes its employees a legal duty to exercise reasonable care to safeguard their sensitive personal information, and that a negligence claim for purely financial losses can go forward. The notification law itself is enforced by the Pennsylvania Attorney General, so the lawsuit is usually brought as a negligence claim for failing to protect the data, not under the notification law.

Consumer Privacy

Can you sue? There is no comprehensive privacy law yet.

Pennsylvania has not enacted a comprehensive consumer data privacy law. House Bill 78, the Consumer Data Privacy Act, passed the House on October 1, 2025, and the Senate amended it in 2026, but it has not passed the Senate and is not law. If it passes, the bill provides it would take effect one year later. Pennsylvania does protect your name and likeness. Under 42 Pa.C.S. § 8316, a person whose name or likeness has commercial value can sue over its unauthorized commercial use.

Artificial Intelligence

Can you sue? No. Only the Attorney General and district attorneys enforce it.

The Artificial Intelligence Deceptive Advertising Act, Act 99 of 2026, was signed October 22, 2026 and takes effect December 21, 2026. It requires a clear and conspicuous disclosure when an advertisement uses AI-generated or AI-modified content in a way that creates a false impression about the nature, origin, or authenticity of the goods or services. Evidently fictional content, parody, satire, commentary, criticism, and text-only content are exempt. The Attorney General or a district attorney may seek an injunction, and a court may impose a civil fine of up to $3,000 per violation. The law does not create a private right of action, and a disclosure does not excuse conduct that violates other laws.

Federal Law Applies Too

The federal TAKE IT DOWN Act makes publishing a nonconsensual intimate image, real or AI-generated, a federal crime. Since May 19, 2026, covered platforms must remove one within 48 hours of a valid request, and the FTC enforces that deadline at TakeItDown.ftc.gov. The Act does not let victims sue. A separate federal civil claim, 15 U.S.C. § 6851, covers disclosure of real intimate images with up to $150,000 in liquidated damages plus attorney fees. Whether it reaches AI fakes is unsettled. The DEFIANCE Act, which would add a federal claim for AI fakes, passed the Senate in January 2026 and is not law.

Get Help

Read our guides on image-based sexual abuse, AI deepfake nudes, and sextortion. Contact Gabriel Vincent Tese, Esq. at Spector Gadon Rosen Vinci, PC (gtese@sgrvlaw.com) for a confidential consultation. This guide is general information, not legal advice. Laws in this area change often. Spot a change we missed? Email gtese@sgrvlaw.com.